{"id":"CVE-2025-29070","aliases":["AZL-59467","AZL-61816","DEBIAN-CVE-2025-29070","EUVD-2025-9489","GHSA-qgv4-vprj-x2fq","ROOT-OS-DEBIAN-12-CVE-2025-29070"],"status":"disputed","title":"A heap buffer overflow vulnerability has been identified in thesmooth2() in cmsgamma.c in lcms2-2...","description":"A heap buffer overflow vulnerability has been identified in thesmooth2() in cmsgamma.c in lcms2-2.16 which allows a remote attacker to cause a denial of service. NOTE: the Supplier disputes this because \"this is not exploitable as this function is never called on normal color management, is there only as a helper for low-level programming and investigation.\"","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00982,"percentile":0.62567,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-122"],"published":"2025-04-01T00:00:00Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"Root:Debian:12","package":"lcms2","fixed_in":["2.14-2+deb12u1.aikido.2"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"rootio-lcms2","fixed_in":["2.14-2+deb12u1.aikido.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:2","package":"openjpeg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.3.1-12"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"openjpeg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.3.1-12"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"lcms2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.14-2","2.14-2+deb12u1","2.16-1","2.16-2","2.17-1","2.17-1.1","2.19.1-1"]},{"source":"osv","ecosystem":"Debian:13","package":"lcms2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.16-2","2.16-2+deb13u1","2.16-2+deb13u2","2.17-1","2.17-1.1","2.19.1-1"]},{"source":"osv","ecosystem":"Debian:14","package":"lcms2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.16-2","2.17-1","2.17-1.1","2.19.1-1"]},{"source":"osv","ecosystem":"Root:Debian:12","package":"lcms2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.14-2+deb12u1.aikido.2"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"rootio-lcms2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.14-2+deb12u1.aikido.2"}]}]}],"references":[{"url":"https://github.com/mm2/Little-CMS/issues/475","tags":["report"]},{"url":"https://github.com/mm2/Little-CMS/issues/475#issuecomment-2696785063","tags":["report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-29070","tags":["web"]},{"url":"https://github.com/advisories/GHSA-qgv4-vprj-x2fq"},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-29070","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-29070","description":"A heap buffer overflow vulnerability has been identified in thesmooth2() in cmsgamma.c in lcms2-2.16 which allows a remote attacker to cause a denial of service. NOTE: the Supplier disputes this because \"this is not exploitable as this function is never called on normal color management, is there only as a helper for low-level programming and investigation.\"","status":"disputed","published":"2025-04-01T00:00:00Z","modified":"2025-04-04T20:25:30.475Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T14:32:45.797843Z"}],"euvd":[{"id":"EUVD-2025-9489","description":"A heap buffer overflow vulnerability has been identified in thesmooth2() in cmsgamma.c in lcms2-2.16 which allows a remote attacker to cause a denial of service. NOTE: the Supplier disputes this because \"this is not exploitable as this function is never called on normal color management, is there only as a helper for low-level programming and investigation.\"","status":"published","published":"2025-04-01T00:00:00Z","modified":"2025-04-04T20:25:30Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T20:52:42.001814Z"}],"ghsa":[{"id":"GHSA-qgv4-vprj-x2fq","title":"A heap buffer overflow vulnerability has been identified in thesmooth2() in cmsgamma.c in lcms2-2...","description":"A heap buffer overflow vulnerability has been identified in thesmooth2() in cmsgamma.c in lcms2-2.16 which allows a remote attacker to cause a denial of service.","status":"published","published":"2025-04-01T21:31:30Z","modified":"2025-04-04T21:30:50Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T15:00:48.912758Z"}],"nvd":[{"id":"CVE-2025-29070","description":"A heap buffer overflow vulnerability has been identified in thesmooth2() in cmsgamma.c in lcms2-2.16 which allows a remote attacker to cause a denial of service. NOTE: the Supplier disputes this because \"this is not exploitable as this function is never called on normal color management, is there only as a helper for low-level programming and investigation.\"","status":"disputed","published":"2025-04-01T21:15:44.023Z","modified":"2026-06-17T09:05:06.7Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T14:10:58.094557Z"}],"osv":[{"id":"CVE-2025-29070","description":"A heap buffer overflow vulnerability has been identified in thesmooth2() in cmsgamma.c in lcms2-2.16 which allows a remote attacker to cause a denial of service. NOTE: the Supplier disputes this because \"this is not exploitable as this function is never called on normal color management, is there only as a helper for low-level programming and investigation.\"","status":"published","published":"2025-04-01T21:15:44.023Z","modified":"2026-03-15T14:52:43.07772Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:47.708311Z"},{"id":"DEBIAN-CVE-2025-29070","description":"A heap buffer overflow vulnerability has been identified in thesmooth2() in cmsgamma.c in lcms2-2.16 which allows a remote attacker to cause a denial of service. NOTE: the Supplier disputes this because \"this is not exploitable as this function is never called on normal color management, is there only as a helper for low-level programming and investigation.\"","status":"published","published":"2025-04-01T21:15:44.023Z","modified":"2026-09-01T20:05:45.39590491Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:45.870237Z"},{"id":"AZL-59467","title":"CVE-2025-29070 affecting package openjpeg2 2.3.1-12","description":"A heap buffer overflow vulnerability has been identified in thesmooth2() in cmsgamma.c in lcms2-2.16 which allows a remote attacker to cause a denial of service. NOTE: the Supplier disputes this because \"this is not exploitable as this function is never called on normal color management, is there only as a helper for low-level programming and investigation.\"","status":"published","published":"2025-04-01T21:15:44Z","modified":"2026-04-21T04:37:17.047418Z","updated_at":"2026-11-02T15:28:07.517393Z"},{"id":"AZL-61816","title":"CVE-2025-29070 affecting package openjpeg2 2.3.1-12","description":"A heap buffer overflow vulnerability has been identified in thesmooth2() in cmsgamma.c in lcms2-2.16 which allows a remote attacker to cause a denial of service. NOTE: the Supplier disputes this because \"this is not exploitable as this function is never called on normal color management, is there only as a helper for low-level programming and investigation.\"","status":"published","published":"2025-04-01T21:15:44Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:21.518778Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2025-29070","title":"CVE-2025-29070 in lcms2 - Patched by Root","description":"Root has patched CVE-2025-29070 in the lcms2 package for Root:Debian:12. Multiple fixed versions available.","status":"published","published":"2026-08-25T11:00:00Z","modified":"2026-08-30T14:00:02.292509094Z","updated_at":"2026-11-02T15:53:30.983521Z"}]}}